@pulse-compute/provider-node 0.0.0 → 1.0.0-beta.1

package/README.md

@@ -1,3 +1,62 @@
 # @pulse-compute/provider-node
 
-This is an inert namespace-bootstrap package. It contains no executable code.
+<!-- pulse-package-status:start -->
+> **Support tier:** Implementation/transitive surface<br>
+> **Audience:** Pulse canonical Node provider and compiler maintainers.<br>
+> **Install directly:** No for application projects; select provider: node through the CLI.<br>
+> **Supported entry points:** `@pulse-compute/provider-node/toolchain`<br>
+> **Stability:** The listed built-in toolchain entry is synchronized with the Beta bootstrap contract; other canonical Node provider interfaces remain internal.<br>
+> **Canonical replacement:** `provider: 'node' through @pulse-compute/cli`<br>
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.1/packages/implementation-packages/)
+>
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.1` package policy.
+<!-- pulse-package-status:end -->
+
+Canonical Node provider implementation used internally when a project selects `provider: 'node'`.
+
+Application projects do not install or import this package directly. The supported entry is provider selection through `@pulse-compute/cli`.
+
+## Responsibilities
+
+- declare the Node canonical provider descriptor and capability mappings;
+- execute canonical programs through the Node local/runtime path;
+- realize fetch, config, secret, KV, structured response, opaque pass-through, supported package effects, and invocation-scoped event ingress/acceptance;
+- normalize provider failures into canonical runtime diagnostics;
+- supply compiler/runtime proofs for maintained internal lifecycle surfaces.
+
+## Boundaries
+
+- Canonical handlers never receive Node request/response objects or ambient process authority.
+- Package-specific payload rules remain in their owning package/contracts.
+- Product command behavior remains in the CLI package.
+- JavaScript execution remains an explicitly selected Node target and never an automatic fallback.
+- Event ingress is a bounded FIFO reference adapter with one active invocation per instance; outbound acceptance is a separate exact-frame ledger with no loopback, delivery, retry, persistence, or process-global singleton.
+
+## JavaScript application host boundary
+
+The provider-maintainer JavaScript subpaths are:
+
+```text
+@pulse-compute/provider-node/javascript/target
+@pulse-compute/provider-node/javascript/runtime-host
+@pulse-compute/provider-node/javascript/node-adapter
+@pulse-compute/provider-node/javascript/lifecycle
+```
+
+The graph-backed loader, Web request/response adapter, provider-owned `pulse dev`
+lifecycle, capability adapters, schema codecs, Assets, and bounded GRIP behavior
+are maintained under the target-support and cross-target conformance contracts.
+No automatic fallback occurs, and application projects do not import these
+implementation subpaths directly.
+
+The Node JavaScript provider also realizes canonical `pulse.jwt` verification
+through the package-owned `jose`/Web Crypto verifier. It owns named-secret
+resolution and wall-clock capture; applications cannot select a crypto backend.
+
+## Implementation exports
+
+The package exposes focused compiler and runtime modules for the synchronized
+repository, including `runtime/canonical-api-runtime`. Those exports are
+implementation interfaces, not application-author APIs.
+
+See [Contracts and providers](https://pulsecompute.io/v1.0.0-beta.1/concepts/contracts-and-providers/) and [Implementation packages](https://pulsecompute.io/v1.0.0-beta.1/packages/implementation-packages/).

package/package.json

@@ -1,15 +1,70 @@
 {
   "name": "@pulse-compute/provider-node",
-  "version": "0.0.0",
-  "description": "Inert namespace bootstrap for Pulse.",
+  "version": "1.0.0-beta.1",
   "license": "Apache-2.0",
+  "engines": {
+    "node": "^22.14.0 || ^24.0.0"
+  },
+  "description": "Node-specific Pulse provider adapter, local runtime, and package-owned builders.",
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./compiler": "./src/compiler/index.js",
+    "./compiler/node-adapter": "./src/compiler/node-adapter.js",
+    "./compiler/assets-provider-proof": "./src/compiler/assets-provider-proof.js",
+    "./compiler/node-compiled-wasm-assets-lifecycle-proof": "./src/compiler/node-compiled-wasm-assets-lifecycle-proof.js",
+    "./compiler/route-handler-effect-proof": "./src/compiler/route-handler-effect-proof.js",
+    "./compiler/route-handler-live-origin-proof": "./src/compiler/route-handler-live-origin-proof.js",
+    "./compiler/route-handler-compiled-wasm-bridge": "./src/compiler/route-handler-compiled-wasm-bridge.js",
+    "./compiler/request-json-body-proof": "./src/compiler/request-json-body-proof.js",
+    "./runtime": "./src/runtime/index.js",
+    "./runtime/compiled-wasm-node-adapter-kv": "./src/runtime/compiled-wasm-node-adapter-kv.js",
+    "./runtime/assets-provider": "./src/runtime/assets-provider.js",
+    "./runtime/route-handler-effects": "./src/runtime/route-handler-effects.js",
+    "./compiler/schema-decode-result-proof": "./src/compiler/schema-decode-result-proof.js",
+    "./compiler/schema-response-codec-proof": "./src/compiler/schema-response-codec-proof.js",
+    "./compiler/backend-json-request-body-proof": "./src/compiler/backend-json-request-body-proof.js",
+    "./runtime/canonical-api-runtime": "./src/runtime/canonical-api-runtime.js",
+    "./native/target": "./src/native/target.js",
+    "./toolchain": "./src/toolchain.js",
+    "./javascript/target": "./src/javascript/target.js",
+    "./javascript/runtime-host": "./src/javascript/runtime-host.js",
+    "./javascript/bindings-adapter": "./src/javascript/bindings-adapter.js",
+    "./javascript/node-adapter": "./src/javascript/node-adapter.js",
+    "./javascript/lifecycle": "./src/javascript/lifecycle.js",
+    "./javascript/test-runtime": "./src/javascript/test-runtime.js",
+    "./javascript/support": "./src/javascript/support.js",
+    "./javascript/target-support-policy": "./src/javascript/target-support-policy.js",
+    "./javascript/package-effects": "./src/javascript/package-effects.js",
+    "./javascript/jwt-verifier": "./src/javascript/jwt-verifier.js",
+    "./javascript/grip-broadcast": "./src/javascript/grip-broadcast.js",
+    "./javascript/source-package": "./src/javascript/source-package.js"
+  },
+  "dependencies": {
+    "@pulse-compute/crypto": "1.0.0-beta.1",
+    "@pulse-compute/jwt": "1.0.0-beta.1",
+    "@pulse-compute/runtime": "1.0.0-beta.1",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.1",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.1",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
+    "src",
     "README.md",
     "LICENSE",
     "NOTICE"
   ],
-  "publishConfig": {
-    "access": "public",
-    "tag": "bootstrap"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pulse-compute/pulse.git",
+    "directory": "packages/provider-node"
+  },
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.1/packages/implementation-packages/",
+  "bugs": {
+    "url": "https://github.com/pulse-compute/pulse/issues"
   }
-}
+}

package/src/capabilities.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const NODE_JWT_VERIFY_CAPABILITY = 'jwt.verify';
+
+const NODE_CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
+  'request',
+  'response.json',
+  'response.text',
+  'response.custom',
+  'fetch',
+  'config.get',
+  'secret.get',
+  'kv.get',
+  'kv.put',
+  'event.ingress',
+  'event.emit',
+  'assets.lookup',
+  'grip.broadcast',
+  NODE_JWT_VERIFY_CAPABILITY,
+  'opaque.pass-through'
+]);
+
+const NODE_CANONICAL_PROVIDER_LOWERING = Object.freeze({
+  request: 'node.http.request',
+  'response.json': 'node.http.response.json',
+  'response.text': 'node.http.response.text',
+  'response.custom': 'node.http.response.custom',
+  fetch: 'node.fetch.dispatch',
+  'config.get': 'node.runtime.config.get',
+  'secret.get': 'node.runtime.secret.get',
+  'kv.get': 'node.runtime.kv.get',
+  'kv.put': 'node.runtime.kv.put',
+  'event.ingress': 'node.event.reference.ingress',
+  'event.emit': 'node.event.reference.accept',
+  'assets.lookup': 'node.runtime.assets.lookup',
+  'grip.broadcast': 'node.http.grip.publish',
+  [NODE_JWT_VERIFY_CAPABILITY]: 'node.native.jwt.verify',
+  'opaque.pass-through': 'node.http.response.stream'
+});
+
+const NODE_NATIVE_TARGET_CAPABILITIES = Object.freeze([
+  NODE_JWT_VERIFY_CAPABILITY,
+  'jwt.verify.hs256',
+  'jwt.verify.es256',
+  'secret.get',
+  'event.ingress',
+  'event.emit',
+  'time.wall-clock'
+]);
+
+module.exports = Object.freeze({
+  NODE_JWT_VERIFY_CAPABILITY,
+  NODE_CANONICAL_PROVIDER_CAPABILITIES,
+  NODE_CANONICAL_PROVIDER_LOWERING,
+  NODE_NATIVE_TARGET_CAPABILITIES
+});

package/src/compiler/assets-provider-proof.js

@@ -0,0 +1,434 @@
+'use strict';
+
+function loadAssetsContracts() {
+  try {
+    return require('@pulse-compute/wasm-contracts/assets/contracts');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/assets/contracts.js');
+    }
+    throw error;
+  }
+}
+
+function loadDiagnostics() {
+  try {
+    return require('@pulse-compute/wasm-contracts/diagnostics');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/diagnostics.js');
+    }
+    throw error;
+  }
+}
+
+const assetsContracts = loadAssetsContracts();
+const {
+  PACKAGE_VERSION,
+  normalizeArtifact,
+  normalizeDiagnostic
+} = loadDiagnostics();
+const {
+  createNodeAssetsProvider,
+  createDefaultStoresFromPlan,
+  normalizeHeaders
+} = require('../runtime/assets-provider.js');
+
+const phaseName = 'node-assets-provider-proof';
+
+function clone(value) {
+  if (Array.isArray(value)) return value.map(clone);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, clone(entry)]));
+  return value;
+}
+
+function normalizePlan(input) {
+  const plan = input && input.artifact ? input.artifact : input;
+  if (!plan || typeof plan !== 'object') return undefined;
+  return {
+    ...plan,
+    entries: Array.isArray(plan.entries) ? plan.entries.map(clone) : [],
+    payloadModes: plan.payloadModes ? clone(plan.payloadModes) : undefined
+  };
+}
+
+function plannedEntries(plan) {
+  return (plan && Array.isArray(plan.entries) ? plan.entries : [])
+    .filter((entry) => entry && entry.status !== 'unsupported' && entry.lookup && entry.lookup.store && entry.lookup.key)
+    .map(clone);
+}
+
+function normalizeKey(key) {
+  const text = String(key || '');
+  return text.startsWith('/') ? text : `/${text}`;
+}
+
+function makeDiagnostic(code, message, severity, details) {
+  return normalizeDiagnostic({
+    phase: phaseName,
+    severity: severity || 'error',
+    code,
+    message,
+    hint: details && details.hint,
+    details,
+    loc: { file: '<node-assets-provider-proof>' }
+  });
+}
+
+function headerValue(headers, name) {
+  const lower = String(name).toLowerCase();
+  const found = normalizeHeaders(headers).find(([key]) => String(key).toLowerCase() === lower);
+  return found ? found[1] : undefined;
+}
+
+function resultBody(result) {
+  if (!result) return undefined;
+  if (result.body !== undefined) return String(result.body);
+  if (result.kind === 'stream' && result.bodyStream && Array.isArray(result.bodyStream.chunks)) {
+    return result.bodyStream.chunks.map((chunk) => Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk)).join('');
+  }
+  return undefined;
+}
+
+function check(name, passed, details, failures, diagnostics) {
+  const out = { name, status: passed ? 'ok' : 'error', details: details || {} };
+  if (!passed) {
+    failures.push(out);
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_PROVIDER_SMOKE_FAILED,
+      `Node assets provider proof check failed: ${name}.`,
+      'error',
+      { check: name, details: out.details }
+    ));
+  }
+  return out;
+}
+
+function cloneEntryForPayload(entry, payloadMode, idSuffix) {
+  const next = clone(entry);
+  next.id = `${entry.id || 'asset'}-${idSuffix}`;
+  next.lookup = { ...(next.lookup || {}), payloadMode };
+  next.response = {
+    ...(next.response || {}),
+    lookupId: next.id,
+    payloadMode,
+    payloadStatus: payloadMode === 'binary-buffer' ? 'reserved-with-diagnostic' : 'lowering-plan-only'
+  };
+  return next;
+}
+
+function selectEntry(entries, method) {
+  const upper = String(method || 'GET').toUpperCase();
+  if (upper === 'HEAD') {
+    return entries.find((entry) => String(entry.lookup.method || 'GET').toUpperCase() === 'HEAD') || entries[0];
+  }
+  return entries.find((entry) => String(entry.lookup.method || 'GET').toUpperCase() === upper) || entries[0];
+}
+
+function bodyFixtureForEntry(entry, label) {
+  return `${label}:${entry.lookup.store}:${normalizeKey(entry.lookup.key)}`;
+}
+
+function storesWithBody(entry, body, options = {}) {
+  return {
+    [entry.lookup.store]: {
+      [normalizeKey(entry.lookup.key)]: {
+        status: options.status || (entry.response && entry.response.status) || 200,
+        body,
+        payloadMode: options.payloadMode,
+        cacheControl: entry.lookup.cacheControl,
+        headers: [
+          ['Content-Type', options.contentType || 'text/plain; charset=utf-8'],
+          ['X-PulseWasm-Node-Proof', options.label || '1']
+        ]
+      }
+    }
+  };
+}
+
+function buildNodeAssetsProviderProof(inputs = {}) {
+  const cwd = inputs.cwd || process.cwd();
+  const generatedBy = inputs.generatedBy || PACKAGE_VERSION;
+  const plan = normalizePlan(inputs.assetsLoweringPlan || inputs.plan);
+  const diagnostics = [];
+  if (!plan) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_PROVIDER_PLAN_REQUIRED,
+      'Node assets provider proof requires an assets-lowering-plan artifact.',
+      'error',
+      { hint: 'Emit --assets-lowering-plan before requesting the Node assets provider proof.' }
+    ));
+  }
+
+  const entries = plannedEntries(plan);
+  if (plan && entries.length === 0) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_PROVIDER_PLAN_REQUIRED,
+      'Node assets provider proof requires at least one static assets lookup/respond entry from the lowering plan.',
+      'error',
+      { entries: 0, hint: 'Add assets.lookup("public", "/file.txt") and assets.respond(handle) to the entry source.' }
+    ));
+  }
+
+  const failures = [];
+  const checks = [];
+  const results = {};
+  let proofStores = inputs.stores;
+  let provider;
+
+  if (entries.length > 0) {
+    const getEntry = selectEntry(entries, 'GET');
+    const headEntry = selectEntry(entries, 'HEAD') || getEntry;
+    if (!proofStores) {
+      proofStores = createDefaultStoresFromPlan(plan);
+      proofStores[getEntry.lookup.store] = {
+        ...(proofStores[getEntry.lookup.store] || {}),
+        [normalizeKey(getEntry.lookup.key)]: {
+          status: (getEntry.response && getEntry.response.status) || 200,
+          body: bodyFixtureForEntry(getEntry, 'node-proof'),
+          cacheControl: getEntry.lookup.cacheControl,
+          headers: [['Content-Type', 'text/plain; charset=utf-8']]
+        }
+      };
+      proofStores[headEntry.lookup.store] = {
+        ...(proofStores[headEntry.lookup.store] || {}),
+        [normalizeKey(headEntry.lookup.key)]: {
+          status: (headEntry.response && headEntry.response.status) || 200,
+          body: bodyFixtureForEntry(headEntry, 'node-proof-head'),
+          cacheControl: headEntry.lookup.cacheControl,
+          headers: [['Content-Type', 'text/plain; charset=utf-8']]
+        }
+      };
+    }
+
+    provider = createNodeAssetsProvider({ plan, stores: proofStores, mode: inputs.mode || 'local-static-fixture' });
+    diagnostics.push(...(provider.diagnostics || []));
+
+    const getResult = provider.executeRequest({ method: 'GET', path: getEntry.lookup.key });
+    results.getText = {
+      status: getResult.status,
+      kind: getResult.kind,
+      body: resultBody(getResult),
+      headers: normalizeHeaders(getResult.headers),
+      diagnostics: getResult.diagnostics || []
+    };
+    checks.push(check(
+      'GET text body response returns 200/status and body through Node result ABI',
+      getResult.status === ((getEntry.response && getEntry.response.status) || 200) && getResult.kind === 'text' && typeof getResult.body === 'string' && getResult.body.length > 0,
+      { status: getResult.status, kind: getResult.kind, bodyLength: getResult.body ? String(getResult.body).length : 0 },
+      failures,
+      diagnostics
+    ));
+    checks.push(check(
+      'GET headers/status pass through from provider asset record',
+      Boolean(headerValue(getResult.headers, 'Content-Type')) && headerValue(getResult.headers, 'X-PulseWasm-Asset-Key') === normalizeKey(getEntry.lookup.key),
+      { contentType: headerValue(getResult.headers, 'Content-Type'), assetKey: headerValue(getResult.headers, 'X-PulseWasm-Asset-Key') },
+      failures,
+      diagnostics
+    ));
+    if (getEntry.lookup.cacheControl) {
+      checks.push(check(
+        'GET cache-control policy is preserved when declared in the lowering plan',
+        headerValue(getResult.headers, 'Cache-Control') === getEntry.lookup.cacheControl,
+        { expected: getEntry.lookup.cacheControl, actual: headerValue(getResult.headers, 'Cache-Control') },
+        failures,
+        diagnostics
+      ));
+    }
+
+    const headResult = provider.executeRequest({ method: 'HEAD', path: headEntry.lookup.key });
+    results.head = {
+      status: headResult.status,
+      kind: headResult.kind,
+      body: resultBody(headResult),
+      headers: normalizeHeaders(headResult.headers),
+      diagnostics: headResult.diagnostics || []
+    };
+    checks.push(check(
+      'HEAD returns status/headers with no body',
+      headResult.status === ((headEntry.response && headEntry.response.status) || 200) && headResult.kind === 'empty' && headResult.body === undefined,
+      { status: headResult.status, kind: headResult.kind, body: headResult.body },
+      failures,
+      diagnostics
+    ));
+
+    const missingPath = '/__pulsewasm-missing-asset__';
+    const missingResult = provider.executeRequest({ method: 'GET', path: missingPath });
+    results.missing = {
+      status: missingResult.status,
+      kind: missingResult.kind,
+      passThroughOn404: missingResult.passThroughOn404,
+      diagnostics: missingResult.diagnostics || []
+    };
+    checks.push(check(
+      'missing asset follows 404/pass-through policy',
+      missingResult.status === 404 && missingResult.kind === 'empty' && missingResult.passThroughOn404 === true,
+      { status: missingResult.status, kind: missingResult.kind, passThroughOn404: missingResult.passThroughOn404 },
+      failures,
+      diagnostics
+    ));
+
+    const methodResult = provider.executeRequest({ method: 'POST', path: getEntry.lookup.key });
+    results.unsupportedMethod = {
+      status: methodResult.status,
+      kind: methodResult.kind,
+      headers: normalizeHeaders(methodResult.headers),
+      diagnostics: methodResult.diagnostics || []
+    };
+    checks.push(check(
+      'unsupported methods are diagnosed and rejected',
+      methodResult.status === 405 && (methodResult.diagnostics || []).some((diag) => diag.code === assetsContracts.ASSETS_DIAGNOSTIC_CODES.UNSUPPORTED_METHOD),
+      { status: methodResult.status, diagnosticCodes: (methodResult.diagnostics || []).map((diag) => diag.code) },
+      failures,
+      diagnostics
+    ));
+
+    const streamEntry = cloneEntryForPayload(getEntry, 'stream-pass-through-response', 'stream');
+    const streamPlan = { ...plan, entries: [streamEntry] };
+    const streamProvider = createNodeAssetsProvider({
+      plan: streamPlan,
+      stores: storesWithBody(streamEntry, bodyFixtureForEntry(streamEntry, 'node-proof-stream'), { payloadMode: 'stream-pass-through-response', label: 'stream' })
+    });
+    const streamResult = streamProvider.executeRequest({ method: 'GET', path: streamEntry.lookup.key });
+    results.stream = {
+      status: streamResult.status,
+      kind: streamResult.kind,
+      providerStreamWired: streamResult.providerStreamWired,
+      body: resultBody(streamResult),
+      diagnostics: streamResult.diagnostics || []
+    };
+    checks.push(check(
+      'stream pass-through response is wired for the Node proof path',
+      streamResult.status === 200 && streamResult.kind === 'stream' && streamResult.providerStreamWired === true && resultBody(streamResult).length > 0,
+      { status: streamResult.status, kind: streamResult.kind, providerStreamWired: streamResult.providerStreamWired, bodyLength: resultBody(streamResult).length },
+      failures,
+      diagnostics
+    ));
+
+    const binaryEntry = cloneEntryForPayload(getEntry, 'binary-buffer', 'binary');
+    const binaryPlan = { ...plan, entries: [binaryEntry] };
+    const binaryProvider = createNodeAssetsProvider({
+      plan: binaryPlan,
+      stores: storesWithBody(binaryEntry, Buffer.from('binary-proof'), { payloadMode: 'binary-buffer', label: 'binary' })
+    });
+    const binaryResult = binaryProvider.executeRequest({ method: 'GET', path: binaryEntry.lookup.key });
+    results.binary = {
+      status: binaryResult.status,
+      kind: binaryResult.kind,
+      diagnostics: binaryResult.diagnostics || []
+    };
+    checks.push(check(
+      'binary body/buffer mode remains reserved with diagnostic',
+      binaryResult.status === 501 && (binaryResult.diagnostics || []).some((diag) => diag.code === assetsContracts.ASSETS_DIAGNOSTIC_CODES.BINARY_BODY_RESERVED),
+      { status: binaryResult.status, diagnosticCodes: (binaryResult.diagnostics || []).map((diag) => diag.code) },
+      failures,
+      diagnostics
+    ));
+  }
+
+  const errorDiagnostics = diagnostics.filter((entry) => (entry.severity || 'error') === 'error');
+  const artifact = normalizeArtifact({
+    version: assetsContracts.ASSETS_NODE_PROVIDER_PROOF_VERSION,
+    generatedBy,
+    phase: phaseName,
+    status: errorDiagnostics.length === 0 ? 'ok' : 'error',
+    provider: 'node',
+    providerPackage: '@pulse-compute/provider-node',
+    contractId: assetsContracts.ASSETS_CONTRACT_ID,
+    sourceAssetsLoweringPlanVersion: plan && plan.version,
+    loweringPlanConnected: Boolean(plan && entries.length > 0),
+    providerBehaviorImplemented: true,
+    compiledWasmLowering: false,
+    proofMode: 'direct-provider-smoke-connected-to-lowering-plan',
+    scope: {
+      mode: inputs.mode || 'local-static-fixture',
+      methods: clone(assetsContracts.ASSETS_ALLOWED_METHODS),
+      staticStoreKeyFromLoweringPlan: true,
+      uploads: false,
+      invalidation: false,
+      mutationApis: false,
+      cacheControlPolicy: 'pass-through-when-declared',
+      notFoundPolicy: '404-pass-through'
+    },
+    payloadModes: {
+      textResponseBody: {
+        mode: 'text-response-body',
+        status: 'implemented-now',
+        proof: 'GET response body via Node result ABI'
+      },
+      headerPassThrough: {
+        mode: 'header-pass-through',
+        status: 'implemented-now',
+        proof: 'Content-Type, X-PulseWasm-Asset-Key, and Cache-Control header checks'
+      },
+      statusResultPassThrough: {
+        mode: 'status-result-pass-through',
+        status: 'implemented-now',
+        proof: 'GET and HEAD status checks'
+      },
+      streamPassThroughResponse: {
+        mode: 'stream-pass-through-response',
+        contractStatus: assetsContracts.ASSETS_PAYLOAD_MODE_CLASSIFICATION.streamPassThroughResponse.status,
+        planStatus: plan && plan.payloadModes && plan.payloadModes.stream ? plan.payloadModes.stream.status : undefined,
+        hostSurfaceStatus: assetsContracts.ASSETS_PAYLOAD_MODE_CLASSIFICATION.streamPassThroughResponse.hostSurfaceStatus,
+        status: entries.length > 0 ? 'implemented-node-proof' : 'not-exercised',
+        providerWired: entries.length > 0,
+        proof: 'direct Node provider returns kind=stream with bodyStream chunks'
+      },
+      binaryBodyBufferResponse: {
+        mode: 'binary-buffer',
+        contractStatus: assetsContracts.ASSETS_PAYLOAD_MODE_CLASSIFICATION.binaryBodyBufferResponse.status,
+        planStatus: plan && plan.payloadModes && plan.payloadModes.binary ? plan.payloadModes.binary.status : undefined,
+        status: 'reserved-with-diagnostic',
+        providerWired: false,
+        diagnosticCode: assetsContracts.ASSETS_DIAGNOSTIC_CODES.BINARY_BODY_RESERVED
+      }
+    },
+    entriesConsumed: entries.map((entry) => ({
+      id: entry.id,
+      store: entry.lookup.store,
+      key: entry.lookup.key,
+      method: entry.lookup.method || 'GET',
+      payloadMode: (entry.response && entry.response.payloadMode) || entry.lookup.payloadMode || 'text-response-body',
+      response: entry.response ? { status: entry.response.status, payloadMode: entry.response.payloadMode } : undefined
+    })),
+    smoke: {
+      checks,
+      failedChecks: failures,
+      results
+    },
+    policy: {
+      compilerOwnsProviderBehavior: false,
+      providerOwnsImplementation: true,
+      planBuilderOwner: plan && plan.policy && plan.policy.builderOwner ? plan.policy.builderOwner : '@pulse-compute/assets',
+      providerOwner: '@pulse-compute/provider-node',
+      consumesLoweringPlan: true
+    },
+    summary: {
+      entries: entries.length,
+      checks: checks.length,
+      failedChecks: failures.length,
+      getTextValidated: checks.some((entry) => entry.name.startsWith('GET text') && entry.status === 'ok'),
+      headValidated: checks.some((entry) => entry.name.startsWith('HEAD') && entry.status === 'ok'),
+      notFoundValidated: checks.some((entry) => entry.name.startsWith('missing asset') && entry.status === 'ok'),
+      streamValidated: checks.some((entry) => entry.name.startsWith('stream pass-through') && entry.status === 'ok'),
+      binaryReservedValidated: checks.some((entry) => entry.name.startsWith('binary body') && entry.status === 'ok'),
+      diagnostics: diagnostics.length,
+      errorDiagnostics: errorDiagnostics.length
+    },
+    diagnostics
+  }, cwd);
+
+  return {
+    artifact,
+    diagnostics,
+    entries: artifact.entriesConsumed,
+    smoke: artifact.smoke,
+    hasErrors: errorDiagnostics.length > 0
+  };
+}
+
+module.exports = {
+  buildNodeAssetsProviderProof,
+  phaseName
+};